Data Processing Agreement

Data Processing Agreement

This Data Processing Agreement ("DPA") forms part of the Terms of Service between you ("Controller") and 360Synk Ltd ("Processor").

TODO: Replace this placeholder with final legal text before public launch.

1. Definitions

- Personal Data: As defined in UK GDPR
- Processing: Any operation performed on Personal Data
- Sub-processor: Third party engaged by us to process data

2. Scope

This DPA applies to Personal Data processed by us on your behalf through the Service.

3. Your Responsibilities

You must:
- Ensure lawful basis for data collection
- Provide clear privacy notices
- Respond to data subject requests
- Report relevant security incidents

4. Our Responsibilities

We will:
- Process data only on your instructions
- Ensure personnel confidentiality
- Implement appropriate security measures
- Assist with data subject requests
- Delete data on termination
- Provide audit cooperation

5. Sub-processors

We use approved sub-processors listed at: https://360synk.co.uk/subprocessors

You will be notified of sub-processor changes with 30 days to object.

6. International Transfers

We use Standard Contractual Clauses for transfers outside UK/EEA.

7. Security Measures

- 256-bit TLS encryption
- Data encrypted at rest
- Access controls and authentication
- Regular security audits
- Incident response procedures

8. Data Breach Notification

We will notify you of data breaches without undue delay, and within 72 hours where feasible.

9. Duration

This DPA remains in effect while we process Personal Data on your behalf.

10. Contact

DPA enquiries: dpo@360synk.co.uk